# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=975 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 976 --- ## [Logstash stopped processing because of an error](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/302291)
**Author:** [@anushka1203](https://discuss.elastic.co/u/anushka1203)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 11:39am UTC](https://discuss.elastic.co/t/logstash-stopped-processing-because-of-an-error/302291 "2022-04-13T11:39:23Z")
Hi, I am trying to send multiple log files to different ES indices. However, Logstash shuts down due to an error. I am a beginner and I could use some help with the same. here is my logstash conf file - input { beats… --- ## [Problem on Short Keywords](https://discuss.elastic.co/t/problem-on-short-keywords/302297)
**Author:** [@icgncl](https://discuss.elastic.co/u/icgncl)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 11:25am UTC](https://discuss.elastic.co/t/problem-on-short-keywords/302297 "2022-04-13T11:25:46Z")
Hello everyone, I have an Elasticsearch index which includes more than 5 fields and my query searches on all these fields. However, today I have realized something wrong. Even though I set fuzziness as 0, when I search … --- ## [Separate file(Lookup file) for grok pattern](https://discuss.elastic.co/t/separate-file-lookup-file-for-grok-pattern/302320)
**Author:** [@vikas.maske](https://discuss.elastic.co/u/vikas.maske)\ **Replies:** 0\ **Last updated:** [April 13, 2022, 11:15am UTC](https://discuss.elastic.co/t/separate-file-lookup-file-for-grok-pattern/302320 "2022-04-13T11:15:40Z")
Hello Team, Thanks for your valuable time. In my entire current ELK setup everyday some new changes needs to be performed on grok patterns and to avoid any human mistakes during changes , I want to use lookup file whi… --- ## [Anomaly detection job severity score change](https://discuss.elastic.co/t/anomaly-detection-job-severity-score-change/302290)
**Author:** [@zerojin63](https://discuss.elastic.co/u/zerojin63)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 10:55am UTC](https://discuss.elastic.co/t/anomaly-detection-job-severity-score-change/302290 "2022-04-13T10:55:08Z")
Hi I've been running an ML job to detect high amount of data stream. Here's specific configuration of the job. Detectors: high\_count partition\_field\_name=src\_ip bucket\_span: 1d So the thing is that the 'severity' of … --- ## [Unable to get new field with mutate filter](https://discuss.elastic.co/t/unable-to-get-new-field-with-mutate-filter/302228)
**Author:** [@zubair\_aftab](https://discuss.elastic.co/u/zubair_aftab)\ **Replies:** 4\ **Last updated:** [April 13, 2022, 10:35am UTC](https://discuss.elastic.co/t/unable-to-get-new-field-with-mutate-filter/302228 "2022-04-13T10:35:10Z")
i split my array temp as below if \[temp\] { split { field =\> "\[temp\]" } } i get different fields, one of the is : temp.isup\_isup\_message\_type Then i want to add a new field based on values in this field : temp.isup… --- ## [How to implement advanced search?](https://discuss.elastic.co/t/how-to-implement-advanced-search/301188)
**Author:** [@TS1997](https://discuss.elastic.co/u/TS1997)\ **Replies:** 2\ **Last updated:** [April 13, 2022, 10:29am UTC](https://discuss.elastic.co/t/how-to-implement-advanced-search/301188 "2022-04-13T10:29:10Z")
Hello, I'm currently developing a site using Pimcore and their Advanced Object Search addon for Elasticsearch but am having issues getting hits on the correct words. A stripped down version of the index itself looks lik… --- ## [QUESTION ABOUT ELK SIEM](https://discuss.elastic.co/t/question-about-elk-siem/301633)
**Author:** [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Replies:** 25\ **Last updated:** [April 13, 2022, 10:24am UTC](https://discuss.elastic.co/t/question-about-elk-siem/301633 "2022-04-13T10:24:44Z")
how i can fix this error permanently when i fix it it shows for me again --- ## [Creating visualization that expands log data when clicking on dashboard object](https://discuss.elastic.co/t/creating-visualization-that-expands-log-data-when-clicking-on-dashboard-object/301916)
**Author:** [@Kenneth\_Rodriguez](https://discuss.elastic.co/u/Kenneth_Rodriguez)\ **Replies:** 2\ **Last updated:** [April 13, 2022, 9:39am UTC](https://discuss.elastic.co/t/creating-visualization-that-expands-log-data-when-clicking-on-dashboard-object/301916 "2022-04-13T09:39:32Z")
Is it possible to create a visualization that expands all relevant log data when clicking on a value in dashboard object? For example, I have a pie chart in a dashboard that that tells me the country of origin from traff… --- ## [Successful create index pattern but when go to discovery tab it show "No results match your search criteria"](https://discuss.elastic.co/t/successful-create-index-pattern-but-when-go-to-discovery-tab-it-show-no-results-match-your-search-criteria/302192)
**Author:** [@Sugoy](https://discuss.elastic.co/u/Sugoy)\ **Replies:** 5\ **Last updated:** [April 13, 2022, 9:37am UTC](https://discuss.elastic.co/t/successful-create-index-pattern-but-when-go-to-discovery-tab-it-show-no-results-match-your-search-criteria/302192 "2022-04-13T09:37:39Z")
can anyone help me, i using ELK to logging mikrotik using this tutorial Push logs and data into elasticsearch - Part 2 Mikrotik Logs it successful create index pattern but when go to discovery tab it show "No results mat… --- ## [Parsing query string with custom aggregation, using Search API](https://discuss.elastic.co/t/parsing-query-string-with-custom-aggregation-using-search-api/302200)
**Author:** [@veggiss](https://discuss.elastic.co/u/veggiss)\ **Replies:** 2\ **Last updated:** [April 13, 2022, 9:32am UTC](https://discuss.elastic.co/t/parsing-query-string-with-custom-aggregation-using-search-api/302200 "2022-04-13T09:32:17Z")
I've installed a plugin to elastic (GitHub - opendatasoft/elasticsearch-aggregation-geoclustering: An Elasticsearch plugin to aggregate Geo Points in clusters.) and I have an endpoint (high level rest client) that takes … --- ## [ElasticSearch pods are in intializing dstate after configuring xpack security and tls](https://discuss.elastic.co/t/elasticsearch-pods-are-in-intializing-dstate-after-configuring-xpack-security-and-tls/302310)
**Author:** [@s19k15](https://discuss.elastic.co/u/s19k15)\ **Replies:** 0\ **Last updated:** [April 13, 2022, 9:19am UTC](https://discuss.elastic.co/t/elasticsearch-pods-are-in-intializing-dstate-after-configuring-xpack-security-and-tls/302310 "2022-04-13T09:19:55Z")
I am having an Elasticsearch deployment on a kubernetes cluster that was deployed with a 7.x chart and i changed the image to 8.x. This worked but now i need to enable new security feature, I have the following values: -… --- ## [file.name":"module/wrapper.go","file.line":259},"message":"Error fetching data for metricset kibana.status: error making http request: Get \\"https://kibana/api/status\\": x509: certificate signed by unknown authority](https://discuss.elastic.co/t/file-name-module-wrapper-go-file-line-259-message-error-fetching-data-for-metricset-kibana-status-error-making-http-request-get-https-kibana-api-status-x509-certificate-signed-by-unknown-authority/302304)
**Author:** [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)\ **Replies:** 0\ **Last updated:** [April 13, 2022, 8:47am UTC](https://discuss.elastic.co/t/file-name-module-wrapper-go-file-line-259-message-error-fetching-data-for-metricset-kibana-status-error-making-http-request-get-https-kibana-api-status-x509-certificate-signed-by-unknown-authority/302304 "2022-04-13T08:47:16Z")
Im using fleet server and elastic agent to monitoring kibana, i have cert error fleet server is running in a container bootstrap with ansible env: FLEET\_SERVER\_ENABLE: "1" FLEET\_URL: "{{ docker\_fleet\_serv… --- ## [Filebeat condition](https://discuss.elastic.co/t/filebeat-condition/302225)
**Author:** [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\ **Replies:** 0\ **Last updated:** [April 12, 2022, 12:28pm UTC](https://discuss.elastic.co/t/filebeat-condition/302225 "2022-04-12T12:28:35Z")
Hi, I use filebeat to read logs from different paths so for example filebeat.yml filebeat.inputs: - type: log enabled: true paths: - D:\\elastic\_stack\\LOGS\\test-LOGS1\\\* fields: kafka\_topic: "kafka-top… --- ## [Rest API: load the color details with mapping](https://discuss.elastic.co/t/rest-api-load-the-color-details-with-mapping/302081)
**Author:** [@octagon.mobile](https://discuss.elastic.co/u/octagon.mobile)\ **Replies:** 4\ **Last updated:** [April 13, 2022, 8:06am UTC](https://discuss.elastic.co/t/rest-api-load-the-color-details-with-mapping/302081 "2022-04-13T08:06:11Z")
The Rest API Bulk Get (api/saved\_objects/\_bulk\_get) doesn't return the colors used in a pie chart, unless user updates the color of pie chart slice. With default colors the response "uiStateJSON" is empty {} But when I… --- ## [Heartbeat doesn't discover anything on Kubernetes](https://discuss.elastic.co/t/heartbeat-doesnt-discover-anything-on-kubernetes/301819)
**Author:** [@tirelibirefe](https://discuss.elastic.co/u/tirelibirefe)\ **Replies:** 4\ **Last updated:** [April 12, 2022, 11:07pm UTC](https://discuss.elastic.co/t/heartbeat-doesnt-discover-anything-on-kubernetes/301819 "2022-04-12T23:07:18Z")
Hello, I've Elastic Stack 8.1 installed. This is my heartbeat config below: heartbeat.yml: |- heartbeat.autodiscover: # Autodiscover pods providers: - type: kubernetes resource: pod … --- ## [Reindex is failing slice option](https://discuss.elastic.co/t/reindex-is-failing-slice-option/302293)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 0\ **Last updated:** [April 13, 2022, 6:25am UTC](https://discuss.elastic.co/t/reindex-is-failing-slice-option/302293 "2022-04-13T06:25:06Z")
We have an index with 28 shards. Reindex is failing when we use the slice option as below. POST https://localhost:9200/\_reindex?wait\_for\_completion=false&slices=10 {"source":{ "index": "OldIndex"},"dest":{ "index": "new… --- ## [Running Elasticsearch with expired license](https://discuss.elastic.co/t/running-elasticsearch-with-expired-license/302282)
**Author:** [@Chris\_Gatihi](https://discuss.elastic.co/u/Chris_Gatihi)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 5:27am UTC](https://discuss.elastic.co/t/running-elasticsearch-with-expired-license/302282 "2022-04-13T05:27:25Z")
Hi, My team is running Elasticsearch 7.16.3 with an enterprise license that is about to expire. We use X-Pack but as far as I know that became open-source since we started using it and we don't actively use any of the … --- ## [Are there any tiny tracks which can be used to run quickly to see everything is fine.?](https://discuss.elastic.co/t/are-there-any-tiny-tracks-which-can-be-used-to-run-quickly-to-see-everything-is-fine/302288)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 5:19am UTC](https://discuss.elastic.co/t/are-there-any-tiny-tracks-which-can-be-used-to-run-quickly-to-see-everything-is-fine/302288 "2022-04-13T05:19:45Z")
I am looking for tiny tracks which can be executed quickly to verify over all cluster and track executions. Thanks --- ## [Using dynamic value in google\_pubsub filter plugin attributes field](https://discuss.elastic.co/t/using-dynamic-value-in-google-pubsub-filter-plugin-attributes-field/302184)
**Author:** [@Altiano\_Gerung](https://discuss.elastic.co/u/Altiano_Gerung)\ **Replies:** 3\ **Last updated:** [April 13, 2022, 3:30am UTC](https://discuss.elastic.co/t/using-dynamic-value-in-google-pubsub-filter-plugin-attributes-field/302184 "2022-04-13T03:30:56Z")
Hi all, I don't know how to give a dynamic value to this attributes field in google\_pubsub output plugin. Currently this is what I do, which is not DRY output { if \[name\] == "userRegistered" { google\_pubsub { … --- ## [Why does not es use FileChannel2SocketChannel to recover shard？](https://discuss.elastic.co/t/why-does-not-es-use-filechannel2socketchannel-to-recover-shard/302224)
**Author:** [@vsop\_479](https://discuss.elastic.co/u/vsop_479)\ **Replies:** 2\ **Last updated:** [April 13, 2022, 2:43am UTC](https://discuss.elastic.co/t/why-does-not-es-use-filechannel2socketchannel-to-recover-shard/302224 "2022-04-13T02:43:23Z")
Why does not es use FileChannel2SocketChannel to recover shard? which can eliminate the copy between user and kernel. The only benefit that sending file though heap, i can think is to control sending rate. Is there an… --- ## [Index filter doesn't work on Data Frame Analytics](https://discuss.elastic.co/t/index-filter-doesnt-work-on-data-frame-analytics/301841)
**Author:** [@shuiqu](https://discuss.elastic.co/u/shuiqu)\ **Replies:** 5\ **Last updated:** [April 13, 2022, 2:19am UTC](https://discuss.elastic.co/t/index-filter-doesnt-work-on-data-frame-analytics/301841 "2022-04-13T02:19:20Z")
I am new to elastic. When I use the machine learning feature I find that Index filter does not seem to work on Data Frame Analytics. I set the filter AveTicketPrice:500 to 600 on kibana\_sample\_data\_flights and saved th… --- ## [Conditional dynamic templates](https://discuss.elastic.co/t/conditional-dynamic-templates/302243)
**Author:** [@channing\_froom](https://discuss.elastic.co/u/channing_froom)\ **Replies:** 1\ **Last updated:** [April 13, 2022, 1:59am UTC](https://discuss.elastic.co/t/conditional-dynamic-templates/302243 "2022-04-13T01:59:26Z")
Is it possible to set up dynamic templates through conditions, for example i have an attributes object in my index which holds only dynamic data, there are hundreds of possible combinations of data that is passed into th… --- ## [How to search on a graph using elastic search?](https://discuss.elastic.co/t/how-to-search-on-a-graph-using-elastic-search/302173)
**Author:** [@Mujo](https://discuss.elastic.co/u/Mujo)\ **Replies:** 1\ **Last updated:** [April 12, 2022, 11:47pm UTC](https://discuss.elastic.co/t/how-to-search-on-a-graph-using-elastic-search/302173 "2022-04-12T23:47:20Z")
I'm thinking about building a search engine based on syntactic structure of a sentences. For example, an entry "Gus is learning piano" will be stored in a syntactically enriched form such as, {{"Gus", nsubj, "learning"… --- ## [Too many buckets](https://discuss.elastic.co/t/too-many-buckets/302275)
**Author:** [@mario-slowinski](https://discuss.elastic.co/u/mario-slowinski)\ **Replies:** 0\ **Last updated:** [April 12, 2022, 9:34pm UTC](https://discuss.elastic.co/t/too-many-buckets/302275 "2022-04-12T21:34:20Z")
Hello In environment with almost 200 hosts, each sends metricbeat (i.e. network metrics every 30 seconds) to single Elasticsearch cluster. There is a business requirement to visualize incoming network traffic bandwidth … --- ## [How to change kibanas default port](https://discuss.elastic.co/t/how-to-change-kibanas-default-port/302104)
**Author:** [@gustavoluza](https://discuss.elastic.co/u/gustavoluza)\ **Replies:** 9\ **Last updated:** [April 12, 2022, 8:28pm UTC](https://discuss.elastic.co/t/how-to-change-kibanas-default-port/302104 "2022-04-12T20:28:29Z")
Hi, whe i need to access my kibana from a browser, i need to put ip:5601, how i change the default kibanas port that to use 443 port and just use https://ip to access kibana? --- ## [Metricbeat Cluster Monitoring: logstash.node: Could not find field 'id' in Logstash API response](https://discuss.elastic.co/t/metricbeat-cluster-monitoring-logstash-node-could-not-find-field-id-in-logstash-api-response/299651)
**Author:** [@marcus\_lhisp](https://discuss.elastic.co/u/marcus_lhisp)\ **Replies:** 16\ **Last updated:** [April 12, 2022, 6:36pm UTC](https://discuss.elastic.co/t/metricbeat-cluster-monitoring-logstash-node-could-not-find-field-id-in-logstash-api-response/299651 "2022-04-12T18:36:41Z")
Hello Community, Today I've upgraded our ELK Stack from 8.0 to 8.1. Since then the metricbeat, running on the logstash node, started to log something that I wasn't able to figure out by myself with my "Google-fu". Bes… --- ## [This version of the ElasticsearchIO is only compatible with Elasticsearch v7.x, v6.x, v5.x and v2.x](https://discuss.elastic.co/t/this-version-of-the-elasticsearchio-is-only-compatible-with-elasticsearch-v7-x-v6-x-v5-x-and-v2-x/302253)
**Author:** [@Pavlo\_Kovalenko](https://discuss.elastic.co/u/Pavlo_Kovalenko)\ **Replies:** 1\ **Last updated:** [April 12, 2022, 6:04pm UTC](https://discuss.elastic.co/t/this-version-of-the-elasticsearchio-is-only-compatible-with-elasticsearch-v7-x-v6-x-v5-x-and-v2-x/302253 "2022-04-12T18:04:29Z")
I need to integrate Google BigQuery into elasticsearch. I used Job template "BigQuery to elasticsearch" from DataFlow in Google console. But it is impossible because my elastic version is 8.1.2. And I got error java.lan… --- ## [Tcp/tcp.go:230 dial failed with: dial tcp localhost:8095: i/o timeout](https://discuss.elastic.co/t/tcp-tcp-go-230-dial-failed-with-dial-tcp-localhost-i-o-timeout/302261)
**Author:** [@BKS](https://discuss.elastic.co/u/BKS)\ **Replies:** 0\ **Last updated:** [April 12, 2022, 5:23pm UTC](https://discuss.elastic.co/t/tcp-tcp-go-230-dial-failed-with-dial-tcp-localhost-i-o-timeout/302261 "2022-04-12T17:23:04Z")
Hi, I have configured heartbeat service to monitor the micro services to get the status of up/down. In Kibana heartbeat dashboard, status is showing as down, but in actually the service is running over the mentioned po… --- ## [Handling multiline with filebeat](https://discuss.elastic.co/t/handling-multiline-with-filebeat/301000)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 7\ **Last updated:** [April 12, 2022, 5:05pm UTC](https://discuss.elastic.co/t/handling-multiline-with-filebeat/301000 "2022-04-12T17:05:12Z")
Hello, I have the following snippet, and I am trying to capture all of it as a multiline \<\< JESI\>\> \[ERROR\] \[TIME:29 Mar 2022 04:34:53\]\[Tid:OUTBOUND\_RECOVERY\_01339\]Exception @\[NodeId=6;Element=Channel@amdocs/eai/adaptor… --- ## [How to show the pipeline conf source filename of error in logs](https://discuss.elastic.co/t/how-to-show-the-pipeline-conf-source-filename-of-error-in-logs/302201)
**Author:** [@Mahf](https://discuss.elastic.co/u/Mahf)\ **Replies:** 8\ **Last updated:** [April 12, 2022, 4:52pm UTC](https://discuss.elastic.co/t/how-to-show-the-pipeline-conf-source-filename-of-error-in-logs/302201 "2022-04-12T16:52:19Z")
Hello, We have multiple logstash conf files that we run simultaneously, the problem is that when we have many errors come from several pipelines, so we can't tell which one is the source of the error, sometimes it's eas… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=974) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=976)